Web Hosting Talk : Web Hosting Main Forums : VPS Hosting : Looking for ddos protected vps?

[Stephen3]

Hello, my site recently under ddos attack and they ask for money to stop the attack. My host have installed mod_evasive on the server but it still no work and they ask for move the site.

Anyone can recommend me any good ddos protected hosting/vps?

[cristibighea]

You might be able to find something with some DDoS protection, but it will be more expensive, and also will not be able to hold against large attacks(over 1gbps).

[Westman]

Looks like you need professional proxy shield or ddos blocker.

[reloaded]

WiredTree offers "ServerShield": a comprehensive software security and optimization suite. I've been with them for more than 8 months now, and recommend them highly.

[BuffaloBill]

What type of DDoS attack is it and how much bandwidth are you using?

[Stephen3]

Originally Posted by BuffaloBill

What type of DDoS attack is it and how much bandwidth are you using?

I'm not sure what type of ddos is it, my host have suspended the site temporary and my other site can online normally.

My site monthly bandwidth only have 10GB around but that day under ddos attack bandwidth have used 2gb+ already.

[Duplex-Group]

Hello,

Could i ask how did you know your site was being DDoS'ed,

Did you vps become "laggy", slow or did it halt?
Or did you host just contact you and tell you this?

Thanks,
Chris,

[Stephen3]

Originally Posted by Duplex-Group

Hello,

Could i ask how did you know your site was being DDoS'ed,

Did you vps become "laggy", slow or did it halt?
Or did you host just contact you and tell you this?

Thanks,
Chris,

The attacker email told me they are attacking my site and ask to pay them $30 to stop attack.
My host install mod_evasive and my site have back online, but after 2 days my site have down again...

[Duplex-Group]

Hmm, Sounds abit strange to me,

What is your hosts website and what is your website?


Thanks,
Chris,

[PogiWeb]

Originally Posted by Stephen3

Hello, my site recently under ddos attack and they ask for money to stop the attack. My host have installed mod_evasive on the server but it still no work and they ask for move the site.

Anyone can recommend me any good ddos protected hosting/vps?

Did you try to install a software firewall?

[BuffaloBill]

Originally Posted by Stephen3

I'm not sure what type of ddos is it, my host have suspended the site temporary and my other site can online normally.

My site monthly bandwidth only have 10GB around but that day under ddos attack bandwidth have used 2gb+ already.

This honestly does not sound like a DDoS.
You might have been hacked or someone is requesting one of your sites a lot, but a DDoS is much more complicated than that.

Millions of Syn-Acks.
Millions of zombies doing HTTP request dropps.
Millions of UDP floods....
THOSE are DDoS attacks.

What you are getting is not a DDoS attack (at least in my opinion).


What are they doing to bring your site down? What service are they knocking out?

[Duplex-Group]

To me it sounds like his host maybe just trying to get some $$$ out of him by maybe halting his vps,

but because he hasnt stated the host yet i cant judge on that,

But i also agree with Bill it doesnt sound a like a ddos at all,

Thanks,
Chris,

[BuffaloBill]

Originally Posted by Duplex-Group

To me it sounds like his host maybe just trying to get some $$$ out of him by maybe halting his vps,

Ahh!!! Duplex you raise a very good point!
Now that I never thought of!!!
But yes... the old "oversell and I'm too small to afford you plan". Many of these companies oversell the hell out of their services and then as soon as someone actually uses any part of it they will say "it's a DDoS, you are shut down".

I guess they could be somewhat telling the truth though. A DDoS for someone could be normal traffic to someone else. I mean if Google was to just send the normal company 1/1000th of their DNS traffic it would shut down most of these hosting companies and it would be sort of a DDoS (tons of people hitting your systems and causing it not to respond at all).


But yeah.... This still does not sound like a DDoS at all.

[Stephen3]

Originally Posted by Matt.G

Did you try to install a software firewall?

What kind of software did you mean? My host have install the mod_evasive only.

[Stephen3]

Originally Posted by BuffaloBill

This honestly does not sound like a DDoS.
You might have been hacked or someone is requesting one of your sites a lot, but a DDoS is much more complicated than that.

Millions of Syn-Acks.
Millions of zombies doing HTTP request dropps.
Millions of UDP floods....
THOSE are DDoS attacks.

What you are getting is not a DDoS attack (at least in my opinion).


What are they doing to bring your site down? What service are they knocking out?

My site have down 2 time, first time is on 3rd of Sept.
I received an email said that they are attacking my site and ask for money to stop attack.
I inform my host about this and they reply:

I could find some instances of ddos attack, there were a lot of apache processes running. Please see the list of IPs which were establishing more than 100 connections:
=====
122 58.241.213.125
148 124.64.38.160
169 219.138.203.2
720 219.130.169.240
=====

and they install mod_evasive and the site back online after few hour, but it still keep down so my host have suspended my account temporary. During this time all my other site are loading fine.

After 3~4days, I unsuspend my account and it online for few days. I received email from the attacker and my site down again, My site become 403 forbidden and they reply:

This is the account that has continued to cause all the problems that the server you are on has been encountering. After disabling the account, all issues were resolved.

You will need to do something about this account, either moving it to another server or disabling the account/terminating.

The issue is causing node instability not just for users on the server you're on, but our VPS customers as well. We cannot tollerate this, as it is causing service disruption to our other customers.

I would recommend moving this site to a DDoS protected host, since it seems to be a constant issue.